Skip to main content

Getting Started

This walks through going from "no account" to "first scan report" using SecretsBuster.

If you just want to try the detection without signing up, you can run a one-off scan from the homepage search box — enter a URL and get a report immediately. This is meant for demonstration purposes only (it only crawls the submitted URL and its associated resources); for anything ongoing, follow the steps below to create an account.

1. Verify your email​

SecretsBuster doesn't use passwords. To create an account, go to secretsbuster.com/account/subscribe, enter your email address, and submit. You'll receive an email with a verification link — this is also how you'll sign back in later (see Signing back in).

2. Choose a plan​

Click the link in the email and you'll be taken to a page showing the available subscription plans. Pick the one that matches how many scans you expect to run per month. If a plan offers a free trial, you can start it without entering payment details; otherwise you'll be redirected to Stripe to complete payment. There's no free-forever plan, but the one-off scanner on the homepage is always available for occasional checks.

3. Get your API key​

After subscribing (or starting a trial), you'll receive a confirmation email with a link to retrieve your API key. Save the key somewhere safe as soon as you see it — it's shown to you once. If you lose it, you can always generate a fresh view of your account and keys by requesting a new sign-in link from secretsbuster.com/account/manage.

Your API key is what you'll use to:

  • Authenticate API requests (in the X-API-Key header — see Using the API).
  • Authenticate the GitHub Action (as a repository secret).
  • Trigger scans from the dashboard (if your plan includes dashboard access).

4. Run your first scan​

You can trigger a scan three ways:

Scanning is asynchronous: however you trigger it, you'll get a report identifier back immediately while the scan runs in the background (typically 10–30 seconds). Check back on the report once it's done.

5. Read the report​

Once a report reaches the CRAWLED state, its scan result tells you what to do next:

  • SAFE — nothing found, no action needed.
  • LEAKY — at least one secret was found. Open the report to see which document leaked what, whether the secret was confirmed still active, and how confident SecretsBuster is that it's a real credential. See Understanding Scan Results for how to interpret this, and review/triage the finding once you've assessed it.
  • ERROR — the target couldn't be scanned; check the error details in the report.

Signing back in (account management)​

Since there's no password, go to secretsbuster.com/account/manage, enter your email address, and follow the link you receive to reach your dashboard, view your subscription and usage, or manage/cancel your subscription through the Stripe customer portal.

Next steps​